Why Cursor Keeps Using Math.random() for Session Tokens (CWE-330)

TL;DR AI editors default to Math.random() for tokens because that's what nearly every tutorial and StackOverflow answer uses Math.random() is not cryptographically secure, so tokens built from it can be predicted or brute-forced Swap in crypto.randomBytes or crypto.randomUUID for anything security-sensitive I was reviewing a password reset flow Cursor had scaffolded for a side project last week. The endpoint looked clean. Route, validation, database call, all fine. Then I got to the token…